Scenario objectives: We have an Exchange Hybrid setup between on-premises and Exchange Online (Office 365). All users are synced and the mailbox is located at Exchange Online.

We need to separate an existing mailbox from its user account and re-connect this mailbox to a new user account. If the mailbox in this scenario was located at the on-premises Exchange it would be an easy process just using the Exchange Management Console. But in a Hybrid scenario, the process includes many steps since the mailbox is not directory conencted to the Active Directory user account but it is conected to the Azure AD Synced User Account.

For the ease of the guide we will name the Existing User Account: OLDUSER and the New User Account: NEWUSER.

We will disconnect the Exchange Online Mailbox from the OLDUSER and connect it to the NEWUSER.

Step 1.

At the on-premises Active Directory, at an OU that is not synced with Azure AD, create the new user account. The “NEWUSER”. Ensure that you do not enter nothing at the email field. Just a user account with no email attributes.

Step 2.

Move the “OLDUSER” to an OU that is not synced with Azure AD

Step 3.

Run a Delta Sync. Go to the server that the AD Connect is installed, open the PowerShell and run “Start-ADSyncSyncCycle”

Step 4.

We need to get the GUID of the NEWUSER. To do so login to a Domain Controller, open PowerShell and run:

[system.convert]::ToBase64String((Get-Aduser NEWUSER).objectGUid.ToByteArray())

Copy the GUID to a Notepad

Step 5.

Open the Office 365 Admin Center and Restore the deleted user “OLDUSER”

Go to Users –> Deleted Users –> Select the user “OLDUSER” –>Click Restore

Step 6.

Connect to Azure AD and set the GUID of the “NEWUSER” to the Office 365 “OLD USER”. Details for connecting to Azure AD “https://technet.microsoft.com/en-us/library/dn975125.aspx“

Connect-MsolService

Set-MsolUser -UserPrincipalName olduser@mydomain.com -ImmutableId vMZGJpW6CUGY09bduJ5dlw==

Step 5.

Open the Office 365 Admin Center and Delete the old user “OLDUSER”

Go to Users –> Active users –> Select the “OLDUSER” –> click Delete user

Step 6.

Clean the on-premises Active Directory account of the old user “OLDUSER” from all attributes that will be added to the new user, like Proxy addresses, Target, address, Alias name, nickname etc.

Step 7.

Make the “NEWUSER” user account a Remote Mailbox object

At the on-premises Exchange, open the Exchange Management Shell and run:

Enable-RemoteMailbox -Identity NEWUSER -DisplayName "NEW USER" -RemoteRoutingAddress newuser@mydomain.onmicrosoft.com -Alias newuser -PrimarySmtpAddress newuser@mydomain.com

Step 8.

Move the “NEWUSER” to an OU that is Synced with Azure AD and run a Delta Sync like Step 3.

After that the “NEWUSER” active directory account will be connected with the “OLDUSER” Exchange Online mailbox and all attributes of the Exchange Online mailbox will be replaced with the “NEWUSER’s” values.

I suppose there are other ways, maybe easier, to accomplish this task, but following this process you will have the desired result without problems.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario appeared first on Apostolidis Cloud Corner.

I prepared a lab with one DC and I created a trial Office 365 E3 account with custom domain. I created users with the same username to both.  At Active Directory I set the UPN to match the Office 365 user name and also added the email address.

Next I enabled directory synchronization from Office 365 and installed Azure AD Connect to DC2. After the initial sync i got this error:

Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [Mail test1@xxxxx.gr;].

I realized that Office 365 could not map the users, it was trying to create new. So there must be an attribute that needs correction. The solution came form the following blog:

http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

and specifically at the “manual match method” section:

In order to match the user with the cloud user you have to set the Immutable ID of onPremise Active Directory user’s ObjectGUID to the immutableID value of the Office365 user.
To retrieve the ObjectGUID you can use the following command:

Ldifde –d “CN=xxx…,OU=xxx,DC=xxxx,DC=xx” –f c:\temp\exportuser1.txt

“CN=xxx…,OU=xxx,DC=xxxx,DC=xx” is the distinguished name of the user. You can use ADSIEdit or the AD Users & Computer (attribute editor) to find this value

In the Textfile exportuser1.txt look for the ObjectGUID. You will find a string like z2Xbu0xFTUapOeDqHRTN1A==

Then connect to Windows Azure Active Director and use the command

set-MsolUser -UserPrincipalName user1.surname1@customerdomain.com -ImmutableId z2Xbu0xFTUapOeDqHRTN1A==

After that I just forced a delta sync “Start-ADSyncSyncCycle -PolicyType Delta” , the sync was successful and the users in Office 365 changed from “In Clout” to “Synced with Active Directory”

How to Map OnPrem Active Directory users to existing Office365 Users

source: http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Match OnPrem Active Directory users to existing Office365 Users appeared first on Apostolidis Cloud Corner.

Select the type of migration endpoint (Outlook Anywhere) and enter the details requested:

• An email address that will be migrated – this is used to test mailbox access during configuration
• Account with privileges – usually a Domain Administrator, but it can be another user, in which case you must assign permissions as specified here
• The privileged account you specify will be used to autodiscover the connection settings and test access to the mailbox specified above.

Click next and verify that the correct details have been populated in the next dialogue box:

Now that the endpoint has been tested you just need to define values for the number of concurrent migrations and supply a descriptive name for the endpoint.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Create migration endpoint | (Cutover & Staging Migration) appeared first on Apostolidis Cloud Corner.

to create the certificate request:

http://exchangeserverpro.com/create-ssl-certificate-request-exchange-2013/

to compete the pending request:

http://exchangeserverpro.com/exchange-2013-complete-pending-certificate-request/

and to enable it:

http://exchangeserverpro.com/exchange-2013-assign-ssl-certificate-to-services/

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Exchange 2013 Add public certificate and enable it appeared first on Apostolidis Cloud Corner.

Now, Step-by-Step:

Lets say that the Mail-Enabled PF’s name is mypublicfolder and the Email Address is mypublicfolder@mydomain.gr

1. Open Exchange Management Console
2. Go to “Receipient Configuration” / “Mail Contact” / “New Mail Contact”
   
3. Select “New Contact” and click Next
4. Since the we cannot add the same details as the Public Folder, enter something similar just to remember, I use the “-O365” extension like this:
   Name: mypublicfolder-O365
   Alias: mypublicfolder-O365
   External e-mail address: mypublicfolder-O365@mydomain.gr
   
5. Click Next, New and finally Finish to create the Mail Contact
6. Open Active Directory Users & Computers
7. Go to “View” and check the “Advanced Features”
8. Go to the container that the new Mail Contact is located and double click to open the properties
9. Go to the “Attribute Editor” tab and search for the “TargetAddress”
   
10. Click Edit and change the address to the Mail-Enable Public Folders address, in this case the Target Address field should change to: SMTP:mypublicfolder@mydomain.gr
    
11. Click OK, Apply and OK to close the properties.
12. Now go back to the Exchange Management Console and go to “Reciepient Configuration” / “Distribution Group”
    
13. Locate the Distribution Group and add the Mail-Contact as a member.
14. Wait the DirSync to finish a full sync or force it and you are ok.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post DirSync & Mail-Enabled Public Folders Distribution Group Members appeared first on Apostolidis Cloud Corner.

I. Create CSR

1. Open the Exchange Management Console
2. Go to “Server configuration”
3. Right Click the server and select “New Exchange Certificate”
   
4. Enter a friendly name for the new cert. This is just a name. And click next
   
5. Select if you need a wildcard certificate or not. And click next
   
6. Next select the services that the certificate will be used and the public FQDNs and click Next
7. At this step confirm all the names and add/remove as needed
   
8. Configure the organization and location information, and choose a location to generate the certificate request file.
   
9. Next check the summary and press New to create the CSR and Finish to exit the wizard

II. Install the certificate

1. Go to the Exchange Management Console, go again to Server Configuration, right-click the server and choose Complete Pending Request.
2. Select the certificate aquired from the public certification authority and complete the wizard. Confirm that the new SSL certificate was imported successfully.
3. The new certificate will appear in the list of thecertificates

III. Assign the certificate

1. Right-click the new certificate and choose “Assign Services to Certificate”.
   
2. Choose the Exchange server and click Next
3. Select the services to assign to the certificate.
4. Finish the wizard and choose Yest at the promt to overwrite the existing certificate

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Add public certificate on Exchange Server 2010 appeared first on Apostolidis Cloud Corner.

I. Create CSR

1. Open IIS Manager
2. Go to the Default Web Site
   
3. Right Click the default Web Site and select Properties
4. Go to the Directory Security Tab and press the “Server Certificate” button
   
5. The Wizard will start, select the “Create a new certificate” and press Next
   
6. Select “Prepare the request now, but send it later” and press Next
   
7. Enter a name and select 2048 bit length and press Next
   
8. Type the company name at the Organization field and the department at the Organization unit field and press Next
   
9. At the common name field enter the Pulic FQDN of the Exchange Server. In most cases is mail.domain.com. This must be an A recond on the Public DNS that points to the public IP of the Exchange server. Press Next
   
10. Enter the regional settings and press Next
    
11. Browse to the path that the CSR will be created and provide a name for the txt file, like certreq.txt. Press Next twice and the CSR is ready.
    

II. Provide the CSR to the Public Certification Authority and get the certificate. Usually you will be provided with a zip file with all required certificate files.

III. Install the certificate to the IIS

1. We will need the *.cer file provided form the Public Certification Authority.
2. Again go to the Security tab at the IIS manager and press “Server Certificate” (See I. 1-4)
3. Now select “Process the pending request….” and press Next untill the wizard finishes. This will install the certificate.
   
4. Restart the server

IV. Assign the certificate to Exchange

1. To assign the certificate you need to go to each virtual directory and enable the “Require Secure Channel. “
2. At the IIS Manager select Exchange virtual directory and  right click properties
3. Go to the Directory Security tab. Click the Edit button in the Secure Communications section.
4. In the Secure Communications dialogue box check the box Require Secure Channel (SSL).

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Add public certificate on Exchange Server 2003 appeared first on Apostolidis Cloud Corner.

1. Go to the Office 365 Portal, https://portal.office.com
2. Go to “Domains” and click on “Add domain”
   
3. The wizard starts at step 1 “Verify your Domain”, press “lets get started”
4. Type your Domain and press Next
   
5. Now the wizard will provide a txt record to verify the ownership of the domain. This record must be added to the DNS registar of your domain.
   
6. At this point we can go back to the admin portal untill the txt record is added and applied. Just press the menu button, at top left, and click the “Admin” button.
   
7. When the txt record is ready, go to the domain section of the portal, select the domain and press “Start setup” 
   
8. click on “Okay, I’ve added the record” to verify the txt record and that all. After that the wizard will provide a list with all the DNS records that must be added in order to have the Office 365 fully functional. In case you are about to perform any kind of migration (cutover, staged, hybrid, imap) don’t change anything yet.
   

Note: this will also add the domain to the “accepted domains” of Exchange Online

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Add your domain to Office 365 appeared first on Apostolidis Cloud Corner.

1. Add your domain to Office 365 & verify
   This step requires access to the public DNS registar to create a txt record to verify the domain ownership.
2. Configure Outlook Anywhere (link)
3. Add public certificate and enable it for IIS & SMTP (Instructions for Exchange 2003, 2007, 2010, 2013)
4. Disable UM
5. Check Primary SMTP
   The Primary SMTP address of each on-premises mailbox is used to create the email address for a new Office 365 mailbox
6. UPN
   The UPN is used to create the username for the Office 365 user. It is convenient to change the UPN to match the Primary SMTP. This way the new user will have username@publicdomain.com for username (login). If the UPN is local then the new user will be created with username@domain.onmicrosoft.com username.
7. Hide not needed mailboxes
   Cutover migration moves all mailboxes, mail users, mail contacts, and mail-enabled groups that are listed at the GAL. All hidden from address list are excluded.
8. Mail enable security groups
9. Create migration endpoint
10. Create migration batch
11. Start the migration batch
12. Change MX & Autodiscover records to point to O365
    When all mailboxes are migrated to O365, change the MX & Autodiscover records to point to O365. In Exchange 2007, Exchange 2010, and Exchange 2013 you should also set Set-ClientAccessServer AutodiscoverInternalConnectionURI to Null.
13. Stop & Delete the migration batch
14. Assign licenses
15. Remove on-premises Exchange

A very nice article about this: Perform a cutover migration of email to Office 365

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Cutover migration (bullets) appeared first on Apostolidis Cloud Corner.

1. For Exchange 2007 only. From server manager > Feature > Add Features > Add in the ‘RPC over HTTP Proxy’ feature.
2. Go to Exchange Management Console -> Sever Configuration -> Client Access
3. Select the Client Access server
4. In the Action Pane click “Enable Outlook Anywhere”
5. At the wizard add the external host name, e.g. “mail.domain.com”, this must be included at the exchange certificate or you need to create a new certificate
6. Select authentication. In most cases Basic is fine
7. Click enable and then Finish
8. This usually takes 15 minutes. Look for Event ID 3008 at the Application Event log to be sure that it is enabled.

Exchange 2003

1. Install the RPC over HTTP Proxy component on Windows Server 2003 fro mthe Add/Remove components wizard
2. Configure the RPC virtual directory in IIS to use Basic Authentication and SSL. Go to IIS Manager -> Default Web Site -> click the RPC virtual directory, go to the Directory Security tab and disable the Checkbox for Enable Anonymous Access and enable the Basic Authentication checkbox and finally enable SSL.

In Exchange 2013, Outlook Anywhere is enabled by default

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Enable Outlook Anywhere appeared first on Apostolidis Cloud Corner.